The elasticsearch security codebase currently has a single authorization service that is backed by roles for role based access control. As we move forward and consider different methods of authorization we should consider having a different backing that could be supported by policies to accomplish ABAC. This also will provide a way for customers that want to implement their own authorization service a way to do so; many large organizations have a single place where authorization rules are kept and there is a desire to be able to reach out to these to make the authorization decisions.